Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Explorer.exe auto closing  (Read 9709 times)

0 Members and 1 Guest are viewing this topic.

KJ

    Topic Starter


    Starter

    Explorer.exe auto closing
    « on: June 23, 2008, 02:52:16 PM »
    Hey, heres my situation. Every time i open explorer.exe, or when the comp starts,  it closes right back out. Then it tries to open back up, and then closes back out over and over until i close it out manually. I think theres a program doing it but i dont know.

    This started today, before it didnt do anything. Also yesterday i got this program called advanced windowscare from download.com it had 7 million downloads so i think that was safe. And after using it it seemed fine. I cant really find a solution but since im using task manager for everything now i tried to go to desktop earlier, and a wierd message came up that said something like "windows can not find the path ;findlist-C:\documents and settings\me\desktop" which is not usual. And the message auto closed out and after i tried to see waht it was again it kind of frose my computer and i couldnt click on the task manager.

    Well this is really hard for me to figure out, so any help would be really appreciated.

    Here is my HJT log maybe it will help.
    Quote
    Logfile of HijackThis v1.99.1
    Scan saved at 04:46:16 PM, on 2008-06-23
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe
    C:\Program Files\Dell Photo AIO Printer 966\memcard.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\system32\dlcqcoms.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\program files\Mozilla Firefox\firefox.exe
    C:\documents and settings\me\desktop\ps\hijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.charter.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
    O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"
    O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 966\memcard.exe"
    O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Startup: Screenshot Utility.lnk.disabled
    O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
    O4 - Global Startup: Charter High-Speed Security Suite.lnk.disabled
    O4 - Global Startup: Kodak EasyShare software.lnk.disabled
    O4 - Global Startup: Kodak software updater.lnk.disabled
    O4 - Global Startup: Microsoft Office.lnk.disabled
    O4 - Global Startup: ShortKeys Lite.lnk = ?
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
    O15 - Trusted Zone: *.fnismls.com
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: dlcq_device -   - C:\WINDOWS\system32\dlcqcoms.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: Icecast Media Server (Icecast) - Unknown owner - C:\Program Files\Icecast2 Win32\icecastService.exe" "C:\Program Files\Icecast2 Win32 (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    Broni


      Mastermind
    • Kraków my love :)
    • Thanked: 614
      • Computer Help Forum
    • Computer: Specs
    • Experience: Experienced
    • OS: Windows 8
    Re: Explorer.exe auto closing
    « Reply #1 on: June 23, 2008, 04:08:05 PM »
    Let me clarify. Shutting down happens to Windows Explorer only? Otherwise computer is working OK?
    Advanced Windows Care is pretty good program, and I believe, it creates backup.
    Also, your HJT version is outdated.
    Download HijackThis from here:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    Click on Download HijackThis Installer
    Post HijackTHis log.

    KJ

      Topic Starter


      Starter

      Re: Explorer.exe auto closing
      « Reply #2 on: June 23, 2008, 08:55:05 PM »
      Only windows explorer (explorer.exe) closes out by itself. And everything else is fine.

      Thanks for the tip about that HJT thing i saw 2 things that are probably malware already  8) Im probably gonna delete those and tell u what i get in a minute, but i might just wait for ur opinion since ur online now.

      Heres the new log:

      Quote
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 10:50:28 PM, on 2008-06-23
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
      C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
      C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe
      C:\Program Files\Dell Photo AIO Printer 966\memcard.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
      C:\WINDOWS\system32\dlcqcoms.exe
      C:\WINDOWS\system32\drivers\KodakCCS.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\taskmgr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\WINDOWS\system32\defrag.exe
      C:\WINDOWS\system32\sndvol32.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\program files\SwiftSwitch2\SwiftSwitch.exe
      C:\Documents and Settings\ME\Desktop\ps\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.charter.net/
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
      O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"
      O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 966\memcard.exe"
      O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKLM\..\Policies\Explorer\Run: [svchost] C:\WINDOWS\svchost.exe
      O4 - HKCU\..\Policies\Explorer\Run: [{A02B2800-0A1F-1033-1202-030512200001}] "C:\Program Files\Common Files\{A02B2800-0A1F-1033-1202-030512200001}\Update.exe" te-110-12-0000213
      O4 - HKUS\S-1-5-19\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.7.4\webbuying.exe (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
      O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
      O4 - Startup: Screenshot Utility.lnk.disabled
      O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
      O4 - Global Startup: Charter High-Speed Security Suite.lnk.disabled
      O4 - Global Startup: Kodak EasyShare software.lnk.disabled
      O4 - Global Startup: Kodak software updater.lnk.disabled
      O4 - Global Startup: Microsoft Office.lnk.disabled
      O4 - Global Startup: ShortKeys Lite.lnk = ?
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
      O15 - Trusted Zone: *.fnismls.com
      O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
      O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: dlcq_device -   - C:\WINDOWS\system32\dlcqcoms.exe
      O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
      O23 - Service: Icecast Media Server (Icecast) - Unknown owner - C:\Program Files\Icecast2 Win32\icecastService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
      O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
      O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
      O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

      Broni


        Mastermind
      • Kraków my love :)
      • Thanked: 614
        • Computer Help Forum
      • Computer: Specs
      • Experience: Experienced
      • OS: Windows 8
      Re: Explorer.exe auto closing
      « Reply #3 on: June 23, 2008, 09:01:08 PM »
      Don't play with HJT, unless you're 100% sure what you're doing. I'll reply shortly.

      Broni


        Mastermind
      • Kraków my love :)
      • Thanked: 614
        • Computer Help Forum
      • Computer: Specs
      • Experience: Experienced
      • OS: Windows 8
      Re: Explorer.exe auto closing
      « Reply #4 on: June 23, 2008, 09:04:05 PM »
      You have few nasties there.

      Print these instructions out.

      1. Download SUPERAntiSpyware Free for Home Users:
      http://www.superantispyware.com/

          * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
          * An icon will be created on your desktop. Double-click that icon to launch the program.
          * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
          * Close SUPERAntiSpyware.

      PHYSICALLY DISCONNECT  FROM THE INTERNET

      Restart computer in Safe Mode.
      To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

          * Open SUPERAntiSpyware.
          * Under "Configuration and Preferences", click the Preferences button.
          * Click the Scanning Control tab.
          * Under Scanner Options make sure the following are checked (leave all others unchecked):
                o Close browsers before scanning.
                o Scan for tracking cookies.
                o Terminate memory threats before quarantining.
          * Click the "Close" button to leave the control center screen.
          * Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
          * On the left, make sure you check C:\Fixed Drive.
          * On the right, under "Complete Scan", choose Perform Complete Scan.
          * Click "Next" to start the scan. Please be patient while it scans your computer.
          * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
          * Make sure everything has a checkmark next to it and click "Next".
          * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
          * If asked if you want to reboot, click "Yes".
          * To retrieve the removal information after reboot, launch SUPERAntispyware again.
                o Click Preferences, then click the Statistics/Logs tab.
                o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
                o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
                o Please copy and paste the Scan Log results in your next reply.
          * Click Close to exit the program.
      Post SUPERAntiSpyware log.

      RECONNECT TO THE INTERNET

      RESTART COMPUTER!

      2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

          * Double-click mbam-setup.exe and follow the prompts to install the program.
          * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
          * If an update is found, it will download and install the latest version.
          * Once the program has loaded, select Perform full scan, then click Scan.
          * When the scan is complete, click OK, then Show Results to view the results.
          * Be sure that everything is checked, and click Remove Selected.
          * When completed, a log will open in Notepad.
          * Post the log back here.

      The log can also be found here:
      C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
      Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

      RESTART COMPUTER!

      3. Post new HijackThis log.

      KJ

        Topic Starter


        Starter

        Re: Explorer.exe auto closing
        « Reply #5 on: June 23, 2008, 09:47:23 PM »
        doing now thanks

        Broni


          Mastermind
        • Kraków my love :)
        • Thanked: 614
          • Computer Help Forum
        • Computer: Specs
        • Experience: Experienced
        • OS: Windows 8
        Re: Explorer.exe auto closing
        « Reply #6 on: June 23, 2008, 09:52:28 PM »
        :)

        KJ

          Topic Starter


          Starter

          Re: Explorer.exe auto closing
          « Reply #7 on: June 24, 2008, 12:27:42 AM »
          well i guess theres no need to post that log, u fixed it  ;D thanks alot man have a good one

          evilfantasy

          • Malware Removal Specialist
          • Moderator


          • Genius
          • Calm like a bomb
          • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: Explorer.exe auto closing
          « Reply #8 on: June 24, 2008, 12:59:00 AM »
          Lack of symptoms does not gurantee all of the malware is gone. It is advised to continue posting any requested logs until given the all clear by a Malware Removal Specialist.

          Broni


            Mastermind
          • Kraków my love :)
          • Thanked: 614
            • Computer Help Forum
          • Computer: Specs
          • Experience: Experienced
          • OS: Windows 8
          Re: Explorer.exe auto closing
          « Reply #9 on: June 24, 2008, 06:25:03 PM »
          As evil said....